USN-3254-1: Django vulnerabilities

Ubuntu Security Notice USN-3254-1

python-django vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 16.10

Ubuntu 16.04 LTS

Ubuntu 14.04 LTS

Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Django.

Software description

python-django – High-level Python web development framework

Details

It was discovered that Django incorrectly handled numeric redirect URLs. Aremote attacker could possibly use this issue to perform XSS attacks, andto use a Django server as an open redirect. (CVE-2017-7233)

Phithon Gong discovered that Django incorrectly handled certain URLs whenthe jango.views.static.serve() view is being used. A remote attacker couldpossibly use a Django server as an open redirect. (CVE-2017-7234)

Update instructions

The problem can be corrected by updating your system to the following package version: